Struct OIDCClient 

pub struct OIDCClient {
    pub client: OpenIDClient,
    /* private fields */
}

A high-level OpenID Connect (OIDC) client abstraction for performing common flows:

• Discovering provider metadata
• Exchanging authorization codes for tokens
• Fetching user information
• Performing token exchange

Internally, OIDCClient combines:

• An OpenID Connect client (OpenIDClient)
• A reqwest HTTP client (reqwest::Client)
• Local configuration (WorkingConfig)

This design allows dynamic discovery from OIDC configuration, while keeping a ready-to-use validator for verifying ID tokens or access tokens.

Fields

client: OpenIDClient

Implementations

impl OIDCClient

pub async fn from_oidc_config( config: &OIDCConfig, ) -> Result<(Self, Validator), Box<dyn Error>>

Creates a new OIDCClient by dynamically discovering the provider metadata and preparing a Validator to verify tokens.

This method:

• Builds a safe reqwest HTTP client (with redirect following disabled).
• Discovers the OpenID provider metadata from the issuer URL.
• Constructs default validation rules (audience, issuer, leeway).
• Loads the JWKS keys into a Validator.
• Initializes the OpenID Connect client with the discovered metadata.

Arguments

• config - High-level OIDC configuration.

Returns

A tuple of:

• OIDCClient (for performing login and userinfo flows)
• Validator (for verifying ID tokens or access tokens)

Errors

Returns an error if discovery fails, the JWKS endpoint cannot be fetched, or if the HTTP client cannot be built.

pub async fn user_info( &self, access_token: AccessToken, subject: Option<SubjectIdentifier>, ) -> Result<UserInfoClaims<AddClaims, PronounClaim>, UserInfoError<HttpClientError<Error>>>

Fetches user information from the provider’s UserInfo endpoint.

Arguments

• access_token - The access token obtained after login.
• subject - Optionally, the subject (user ID) to query.

Returns

The claims returned by the UserInfo endpoint.

Errors

Returns an error if the request fails or the response is invalid.

pub async fn exchange_code( &self, code: AuthorizationCode, ) -> Result<CoreTokenResponse, Error>

Exchanges an authorization code (received after user login) for a token response.

Arguments

• code - The authorization code.

Returns

The token response, including access token and optionally ID token or refresh token.

Errors

Returns an error if the token request fails or the response is invalid.

pub async fn exchange_token_for_audience( &self, subject_token: &str, audience: &str, ) -> Result<TokenExchangeResponse, Error>

Performs OAuth2 token exchange to obtain a token scoped for a different audience.

Arguments

• subject_token - The current access token or ID token.
• audience - The target audience for the exchanged token.

Returns

The token exchange response, containing the new token.

Errors

Returns a reqwest error if the request fails.

Note

I haven’t tested this in a full flow.

pub async fn from_oidc_config_with_validation( config: &OIDCConfig, custom_validation: Validation, ) -> Result<(Self, Validator), Box<dyn Error>>

Like from_oidc_config, but allows the caller to provide a custom Validation template.

This can be used to:

• Disable signature verification for testing.
• Adjust expiration leeway, audience, issuer, etc.
• Support different algorithms.

Trait Implementations

impl Clone for OIDCClient

fn clone(&self) -> OIDCClient

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OIDCClient

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.